一、环境准备
1、升级操作系统从centos7.8升级到CentOS Linux release 7.9.2009 (Core)
yum update -y
2、安装wget 腾讯云默认已安装
yum install -y wget
3、调整防火墙,腾讯云默认防火墙是关闭状态,打开端口根据业务需要调整
开启防火墙
systemctl start firewalld
添加80,443端口
firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --zone=public --add-port=20000-30000/tcp --permanent
重新载入配置
firewall-cmd --reload
查看防火墙端口配置情况
firewall-cmd --zone=public --list-ports
删除端口
firewall-cmd --zone= public --remove-port=80/tcp --permanent
获取所有支持的ICMP类型
firewall-cmd --get-icmptypes
增加icmp时间戳过滤
firewall-cmd --zone=public --add-icmp-block=timestamp-reply --permanent
firewall-cmd --zone=public --add-icmp-block=timestamp-request --permanent
firewall-cmd --zone=public --add-icmp-block=time-exceeded --permanent
重新载入配置
firewall-cmd --reload
查看过滤规则
firewall-cmd --zone=public --list-icmp-blocks
4、安装htop iftop iotop lsof
yum install -y htop iftop iotop lsof
5、安装了unzip
yum install unzip
6、关闭selinux
临时关闭:
sudo setenforce 0
永久关闭:
vi /etc/selinux/config
将SELINUX=enforcing改为SELINUX=disabled,保存后退出
PHP环境部署
一、PHP安装流程
1、首先安装EPEL软件包:
yum install epel-release
2、然后安装源
rpm -Uvh http://rpms.remirepo.net/enterprise/remi-release-7.rpm
3、查看源的情况
yum repolist all|grep php72
返回结果如下:
------------
[root@VM-1-8-centos ~]# yum repolist all|grep php72
Repository epel is listed more than once in the configuration
remi-php72 Remi's PHP 7.2 RPM repositor disabled
remi-php72-debuginfo/x86_64 Remi's PHP 7.2 RPM repositor disabled
remi-php72-test Remi's PHP 7.2 test RPM repo disabled
remi-php72-test-debuginfo/x86_64 Remi's PHP 7.2 test RPM repo disabled
------------
看起来全都被禁用了,
4、启用第一个
yum-config-manager --enable remi-php72
如果提示没有指令,就自行安装一下
yum -y install yum-utils
5、然后就是安装PHP和PHP相关的插件。
yum install php72 php72-php-fpm php72-php-gd php72-php-json php72-php-mbstring php72-php-mysqlnd php72-php-xml php72-php-xmlrpc php72-php-opcache php72-php-bcmath php72-php-zip
增加redis插件
yum install php72-php-redis
6、启动PHP7.2,同样是使用 service 命令来控制,比如启动
service php72-php-fpm start
或者
systemctl start php72-php-fpm.service
7、查看启动状态
systemctl status php72-php-fpm.service
8、查看php版本
/usr/bin/php72 -v
9、设置开启启动
systemctl enable php72-php-fpm.service
10、安装rar扩展
安装 php72-php-devel否则phpize命令报错
yum install php72-php-devel
下载地址rar安装包
http://pecl.php.net/package/rar
安装扩展,运行以下命令完成安装:
gunzip rar-4.2.0.tgz
tar -xvf rar-4.2.0.tar
cd rar-4.2.0
/opt/remi/php72/root/usr/bin/phpize
./configure --with-php-config=/opt/remi/php72/root/usr/bin/php-config
make && make install
安装完成后,php的扩展目录会自动出现rar.so文件,只需在php.ini文件中引入即可。
编辑php.ini,加入以下代码:
vi /opt/remi/php72/root/usr/lib64/php/modules/
extension=rar.so
重启服务
systemctl restart php72-php-fpm.service
查看扩展
php72 -m
二、安装Nginx
nginx 安装使用编译安装的方式,首先从官网下载安装包,这里选择目前的稳定版1.18。
1、下载安装包
wget https://nginx.org/download/nginx-1.18.0.tar.gz
如果提示 -bash: wget: 未找到命令 ,就安装一个
yum install wget
2、下载后解压缩
tar -zxvf nginx-1.18.0.tar.gz
3、进入到目录,
cd nginx-1.18.0/
4、安装对应依赖
yum install -y gcc gcc-c++
yum install -y pcre pcre-devel
yum install -y zlib zlib-devel
yum install -y openssl openssl-devel
5、然后安装,执行以下命令
./configure
make&&make install
6、启动nginx
进入到nginx的目录,/usr/local/nginx,启动nginx
./nginx
7、测试访问
curl http://127.0.0.1
这时候访问主机的 IP地址,就会显示nginx的欢迎页面。打不开检查一下防火墙。
8、查看nginx版本
/usr/local/nginx/sbin/nginx -V
9、设置为服务并设置开机启动
创建nginx.service文件
vi /usr/lib/systemd/system/nginx.service
然后,用下面内容替换原内容
[Unit]
Description=nginx
After=network.target
[Service]
Type=forking
ExecStart=/usr/local/nginx/sbin/nginx
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s stop
PrivateTmp=true
[Install]
WantedBy=multi-user.target
设置开机自启
systemctl enable nginx.service
10、查看运行状态
systemctl status nginx.service
三、配置Nginx与PHP关联
1、创建一个用户 www
1)、查看用户是否已经有www:
cut -d : -f 1 /etc/passwd
2)、查看用户组:
cut -d : -f 1 /etc/group
3)、创建指定用户和组 www
添加组:
groupadd www
添加用户:
useradd -g www -m www
2、修改php的文件www.conf
vi /etc/opt/remi/php72/php-fpm.d/www.conf
将文件修改如下内容:(默认值是apache)
user www
group www
修改
pm = dynamic为pm = static
pm.max_children = 256 (数据根据内存大小除以30为上限,根据实际情况调整)
修改完成重新启动php-fpm
service php72-php-fpm restart
或者
systemctl restart php72-php-fpm.service
3、修改php.ini
vi /etc/opt/remi/php72/php.ini
1)、调整 memory_limit ,根据内存大小调整 memory_limit = 10240M
2)、调整 upload_max_filesize = 100M
修改完成重新启动php-fpm
service php72-php-fpm restart
或者
systemctl restart php72-php-fpm.service
4、修改nginx的配置
vi /usr/local/nginx/conf/nginx.conf
去掉 user 的注解,改为 www
user www www;
5、设置网站根目录
默认nginx会访问安装目录里面的 html 文件夹,如果需要修改,则需要修改 server 下的 root 项,改成绝对路径。
6、默认配置中有关于PHP的配置,找到如下代码并将注解去掉
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
注意有些区别,fastcgi_param 部分有改动,注意也改一下,否则会出现400错误。
全文配置如下:
user www www;
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server {
listen 80;
server_name _;
root /home/wwwroot/aiapi.jgjykj.com/public;
location / {
index index.html index.htm index.php default.html default.htm default.php;
try_files $uri $uri/ /index.php?$query_string;
if (!-e $request_filename) {
rewrite ^/(.*)$ /index.php?s=/$1 last;
}
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
}
重启Nginx,进入nginx程序目录
./nginx -s reload
或者
/usr/local/nginx/sbin/nginx -s reload
或者
systemctl reload nginx.service
然后就在root指定的目录中创建测试文件 index.php
<?php
phpinfo();
不出意外的话会看到正常的php信息页面
nginx配置针对AI项目优化版本
1、server中root的路径:
测试环境为root /home/wwwroot/aitest.sdchedu.cn/public;
正式环境为root /home/wwwroot/aiapi.jgjykj.com/public;
2、同源问题暂未处理
server {
listen 80;
server_name _;
root /home/wwwroot/aiapi.jgjykj.com/public;
add_header Access-Control-Allow-Origin https://ai.jgjykj.com;
add_header Access-Control-Allow-Credentials true;
add_header Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH;
add_header Access-Control-Allow-Headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization;
location / {
index index.html index.htm index.php default.html default.htm default.php;
#try_files $uri $uri/ /index.php?$query_string;
try_files $uri $uri/ /index.php?$1;
if (!-e $request_filename) {
#一级目录
rewrite ^/index.php(.*)$ /index.php?s=$1 last;
rewrite ^/(.*)$ /index.php?s=/$1 last;
}
if ($request_method = 'OPTIONS') {
add_header Access-Control-Allow-Origin https://ai.jgjykj.com;
add_header Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH;
add_header Access-Control-Allow-Credentials true;
add_header Access-Control-Allow-Headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization;
return 204;
}
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
完整代码
user www www;
worker_processes auto;
worker_cpu_affinity auto;
error_log /home/wwwlogs/nginx_error.log crit;
pid /usr/local/nginx/logs/nginx.pid;
#Specifies the value for maximum file descriptors that can be opened by this process.
worker_rlimit_nofile 51200;
events
{
use epoll;
worker_connections 51200;
multi_accept off;
accept_mutex off;
}
http
{
include mime.types;
default_type application/octet-stream;
server_names_hash_bucket_size 128;
client_header_buffer_size 32k;
large_client_header_buffers 4 32k;
client_max_body_size 50m;
sendfile on;
sendfile_max_chunk 512k;
tcp_nopush on;
keepalive_timeout 60;
tcp_nodelay on;
fastcgi_connect_timeout 300;
fastcgi_send_timeout 300;
fastcgi_read_timeout 300;
fastcgi_buffer_size 64k;
fastcgi_buffers 4 64k;
fastcgi_busy_buffers_size 128k;
fastcgi_temp_file_write_size 256k;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.1;
gzip_comp_level 2;
gzip_types text/plain application/javascript application/x-javascript text/javascript text/css application/xml application/xml+rss;
gzip_vary on;
gzip_proxied expired no-cache no-store private auth;
gzip_disable "MSIE [1-6]\.";
#limit_conn_zone $binary_remote_addr zone=perip:10m;
##If enable limit_conn_zone,add "limit_conn perip 10;" to server section.
server_tokens off;
access_log off;
server {
listen 80;
server_name _;
root /home/wwwroot/aitest.sdchedu.cn/public;
add_header Access-Control-Allow-Origin $http_origin;
add_header Access-Control-Allow-Credentials true;
add_header Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH;
add_header Access-Control-Allow-Headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization;
location / {
index index.html index.htm index.php default.html default.htm default.php;
#try_files $uri $uri/ /index.php?$query_string;
try_files $uri $uri/ /index.php?$1;
if (!-e $request_filename) {
#一级目录
rewrite ^/index.php(.*)$ /index.php?s=$1 last;
rewrite ^/(.*)$ /index.php?s=/$1 last;
}
if ($request_method = 'OPTIONS') {
add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH;
add_header Access-Control-Allow-Credentials true;
add_header Access-Control-Allow-Headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization;
return 204;
}
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
}
N、更新ssh ssl【未处理,影响php环境安装】
由 OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017 升级到 OpenSSH_8.4p1, OpenSSL 1.1.1h 22 Sep 2020
脚本和离线安装包拷贝到root文件夹下,然后执行命令
chmod 777 openssh8.4.sh
./openssh8.4.sh